We want a method to sanitize Cisco IOS 15 routers (ISR Gen 2) before they are removed from the facility. While a "write erase" works perfectly if the router is breathing, how to sanitize dead routers is the current issue.
I have been unable to find a method for encrypting the config file, but we can change the boot configuration to pull the config file from a compact flash card. Then, should the router die, we just remove the compact flash card and dispose of the router.
boot config flash0:startup-config
However, the router still appears to store the config file in the NVRAM, in addition to the compact flash.
CNS-RA1(config)#hostname TEST
TEST(config)#end
TEST#wr
Building configuration...
Compressed configuration from 27166 bytes to 11622 bytes[OK]
TEST#dir flash0:startup-config
Directory of flash0:/startup-config
52 -rw- 37757 Apr 2 2020 12:20:12 -05:00 startup-config
256487424 bytes total (83161088 bytes free)
TEST#dir nvram:startup-config
Directory of nvram:/startup-config
239 -rw- 37757 Apr 2 2020 12:20:12 -05:00 startup-config
262136 bytes total (237453 bytes free)
Is there a way to stop the router from saving a copy of the configuration on the NVRAM?
How do others sanitize dead routers before removal?
write memory
(the default from yourwr
usage), have you tried doing thecopy running-config flash0:/startup-config
? This specifies the target for thecopy
command and so should not update NVRAM.